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^  The  11  September  Hijacker  Cell  Model 


(U)  EXECUTIVE  SUMMARY 

(U)  Key  Findings 

(&NF)  The  11  September  hijackers  successfully  eluded  the  notice  of  US  law  enforcement  and 
intelligence  as  they  plotted  to  commandeer  and  use  four  airliners  as  weapons,  but  details  of  their 
lives  and  activities  can  be  used  to  detect  cells  that  may  follow  the  11  September  hijackers’  model. 

It  should  be  noted,  however,  that  the  1993  attack  on  the  World  Trade  Center  and  the  Millennium 
bombing  plot — the  previous  two  major  international  terrorist  operations  on  US  soil — used  tactics 
that  are  different  in  key  respects  from  the  11  September  model,  suggesting  that  future  sleeper  cells 
will  use  a  variety  of  measures  to  conceal  their  activities. 

•  The  1 1  September  hijackers  were  all  Middle  Eastern  men  between  20  and  33  years  of  age 
who  wore  a  western  style  of  dress  and  grooming. 

•  The  hijackers  entered  the  US  legally  and  used  either  their  true  names  or  variations  of  their 
true  names.  Thirteen  of  the  19  hijackers  traveled  to  the  US  in  groups  of  two  or  three — four 
or  the  remaining  six  were  the  pilots. 

•  Once  in  the  country,  the  hijackers  obtained  typical  US  identification — driver  licenses,  state 

■  identification  cards,  and  commercially  available  documents — likely  in  order  to  avoid  further 
use  of  their  passports. 

•  The  hijackers  changed  residences  frequently. 

•  The  hijackers’  enrollment  at  US  flight  schools  was  not  in  itself  necessarily  uncommon,  but 
their  focus  during  simulation  training  on  learning  only  the  skills  that  would  benefit  their  mission 
distinguished  them  from  typical  students. 

•  The  hijackers  opened  bank  accounts — often  in  pairs — with  money  either  they  brought  legally, 
into  the  US  or  wired  from  overseas. 

•  The  hijackers  largely  avoided  associating  with  radical  Islamic  groups  in  the  US,  likely  in  an 
effort  to  reduce  the  chances  of  detection  by  law  enforcement. 

•  i 

•  The  hijackers’  communications  techniques — face-to-face  meetings,  prepaid  phone  cards,  payphones, 
cell  phones,  the  Internet,  and  possibly  commercially  available  mailboxes — made  it. difficult  to 
trace  their  operational  communications. 
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)  The  11  September  Hijacker  Cell  Model 


fy^/NF)  Al-Qa’ida  leaders  and  key  11  September  plotters  such  as  Usama  Bin  Ladin,  Khalid 
Shaykh  Muhammad  (KSM),  and  Ayman  al-Zawahiri  probably  have  derived  lessons  from  the 
activities  and  experiences  of  the  11  September  hijackers  and  may  be  relying  on  them  to  plan 
future  attacks  against  the  US. 


hi 

b2 

b6 

:b7C 


The  1 1  September  plot  was  at  least  two  years  in  the  making 

i 

Qa’ida  operative  calling 

claimed  in  a  videotaped  interview  in  Jui 

that  al-Qa'ida  sent  a  reconnaissance  team  to  the  US  two  years  before  the  1 1  September  operation. 
We  have  no  information  to  confirm  that  this  reconnaissance  operation  occurred  or  that  it  can 
be  tied  to  the  11  September  attacks,  but  it  is  consistent  with  al-Qa’ida  tradecraft  that  calls  for 
long  and  detailed  planning  for  major  operations. 


*  Al-Qa’ida  has  lost  its  camps  in  Afghanistan  where  the  plot  was  largely  honed  and 
the  hijackers  were  trained,  but  between  10,000-20,000  potential  terrorists  trained  in 
the  camps  and  al-Qaida’s  networks  in  countries  such  as  Pakistan,  Saudi  Arabia,  and 
Indonesia  leave  it  with  an  ample  pool  of  potential  recruits  for  future  attacks. 

(U)  Snapshot  of  the  Hijackers 


(LES)  Al-Qa’ida’s  criteria  in  choosing  the  11  September  hijackers  is  unknown,  but  one  of  the 
most  important  factors  probably  was  their  ability  to  not  arouse  suspicion  from  US  or  foreign 
intelligence  and  law  enforcement  services. 

•  The  hijackers  used  Western-style  clothing  and  grooming  once  in  the  US. 

•  The  hijackers  were  all  Middle  Eastern  men  between  20  and  33  years  of  age.  Many  of  them 
spent  time  in  Afghanistan  in  either  late  1999  or  2000,  according  to  a  variety  of  reporting. 

•  Personal  connections  and  family  ties  among  the  hijackers  also  may  have  been  important; 
among  the  19  were  two  sets  of  brothers — Waled  and  Wa’il  al-Shehri  and  Nawaf  and  Salim  al- 
Hazmi — and  other  sub-groupings  in  which  individuals  appear  to  have  known  each  other  for 
years  before  the  plot. 

(U)  How  They  Entered  the  US 

*  * 

(LES)  The  hijackers  entered  the  US  legally  on  valid  visas — 15  on  B1  tourist  visas,  three  on  B2 
business  visas,  and  one  on  a  FI  student  visa — using  their  true  names. 


Thirteen  of  the  19  hijackers  traveled  to  the  US  in  groups  of  two  or  three — the  four  pilots, 
Mohamed  Atta,  Marwan  al-Shehhi,  Hani  Hanjour,  and  Ziad  Jarrah  are  notable  exceptions. 
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•  The  hijackers  arrived  in  the  US  on  eight  different  airlines:  United,  Delta,  Virgin  Atlantic, 
Swiss  Air,  Sabena,  Ceskosiovski  Air,  Condor,  and  Saudi  Airlines.  Their  flights  departed  from 
Brussels,  Frankfort,  London,  Bangkok,  Zurich,  Riyadh,  Paris,  and  Prague,  and  they  arrived  in 
Newark,  Atlanta,  San  Diego,  Orlando,  Miami,  Washington-Dulles,  New  York -JFK,  and  Los 
Angeles. 

•  The  four  pilots  acquired  their  travel  documents — passports  from  Saudi  Arabia,  United  Arab 
Emirate  (UAE),  and  Egypt,  and  visas  issued  in  Jeddah,  Saudi  Arabia;  Dubai,  DAE;  and 
Berlin,  Germany — between  one  and  five  months  before  entering  the  US.  The  other  hijackers 
acquired  their  documents — Saudi  and  UAE  passpprts  with  visas  issued  mostly  in  Jeddah  and 
Riyadh — from  several  months  to  more  than  a  year  before  entering  the  US. 

•  Most  of  the  hijackers  reported  their  previous  passports  as  lost  or  stolen  and  received  new 
ones  that  revealed  no  travel  to  Afghanistan — a  potential  “red  flag”  that  might  have  invited 
scrutiny  even  prior  to  1 1  September. 

(U)  Where  They  Lived  and  What  They  Drove 

(LES)  The  hijackers’  choices  for  living  arrangements  and  cars  were  nondescript  and  likely  would 
not  have  in  themselves  raised  suspicion. 

•  The  hijackers  usually  lived  in  small  groups  of  two  to  five  and  routinely  moved  between  cheap 
motels  and  apartments.  The  pilots  maintained  relatively  stable  residence  during  their  flight 
training,  obtaining  apartments  for  approximately  six  months. 

i 

•  They  owned  four  older  non-descript  vehicles:  Nawaf  al-Hazmi’s  1988  Toyota  Corolla, 

Jarrah’s  1990  Mitsubishi  Eclipse,  Waleed  al-Shehri’s  1993  Dodge  Colt  and  Atta’s  1989 
Pontiac  Gran  Prix.  The  hijackers  also  rented  a  variety  of  vehicles  27  times  from  several  companies, 
including  Enterprise,  Budget,  and  Alamo. 

(U)  Identification  Used 

,  i 

(LES)  Many  of  the  hijackers  obtained  identification  cards  or  driver  licenses  to  use  instead  of 
their  passports,  which  would  have  called  attention  to  them  as  foreigners. 

•  Eight  hijackers  obtained  driver  licenses  from  Arizona,  California,  and  Florida,  16  obtained 
state  identification  cards  from  Florida  and  Virginia,  and  seven  obtained  commercially  available 
ID  cards.  None  had  social  security  numbers. 

•  At  least  two  hijackers  requested  duplicate  Florida  driver  licenses,  and  both  Atta  and  al-Shehhi 
requested  replacement  pilot  licenses,  leaving  open  the  possibility  that  al-Qa’ida  forgers 
received  the  originals  or  duplicates  and  can  try  to  reproduce  these  items.  • 
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(LES)  Mohamed  Atta  in  Germany:  His  Conduct  Before  Coming  to  the  US 

(LES)  As  an  expatriate  in  Europe,  Atta  behaved  much  like  the  typical  budding  jihadist.  It  was 
only  after  he  apparently  was  tapped  for  his  mission — perhaps  spotted  and  selected  because  of 
this  behavior — and  returned  from  Afghanistan  that  he  began  observing  strict  operational  security 
practices. 

•  Prior  to  early  February  2000,  Atta  and  his  associates  in  Hamburg — including  1 1  September 
pilots  Marwan  al-Shehhi  and  Ziad  Jarrah — were  known  to  wear  beards  and  Arab-style  dress, 
attended  a  mosque  known  for  extremists  views,  and  openly  associated  with  radical  figures— 
all  acts  that  contradict  recommendations  in  al-Qa’ida  training  manuals  not  to  behave  in  ways 
that  would  attract  law  enforcement  attention. 

•  After  defending  his  thesis  in  October  1999,  Atta  left  for  Afghanistan  and  Pakistan  in  late 
November  and  returned  to  Hamburg  in  late  February  2000,  where  he  no  longer  appeared  to  be 
outwardly  radical,  according  to  law  enforcement  and  intelligence  reporting.  He  did  not  wear 
a  beard  or  Arab-style  dress  and  generally  blended  into  the  Western  world.  Shortly  thereafter, 
Atta  applied  for  a  new  passport — apparently  both  to  disguise  his  travel  to  Afghanistan  and 

to  acquire  a  new  photograph — made  inquires  to  US  flight  schools,  received  a  US  visa,  and 
spread  word  to  family  and  friends  that  he  was  leaving  Germany  to  continue  his  education. 


(U)  Flight  Schools 

(LES)  The  hijackers  enrollment  at  multiple  US  flight  schools  was  not  in  itself  uncommon,  but 
their  focus  on  learning  only  the  skills  that  would  benefit  their  mission — such  as  Atta  and  al- 
Shehhi  requesting  advanced  jet  flight  training  that  focused  on  approaches  and  turns  but  not  on 
take-offs  and  landings — made  them  stand-out. 

•  Between  June  2000  and  September  2001,  Atta,  al-Shehhi,  and  Jarrah  took  flying  classes, 
underwent  flight  simulator  training,  and  flew  test  flights  in  at  least  eight  facilities  in  Florida 
and  Georgia:  Atta  and  al-Shehhi  also  visited  the  Airman  Flight  School  in  Oklahoma. 

•  Hanjour  attended  three  flight  schools  in  Arizona  and  California  between  1996  and  1 999. 
After  returning  to  the  US  in  December  2000,  he  took  jet  simulator  lessons  in  Arizona  and 
rented  planes  from  at  least  Five  other  facilities  in  Arizona,  New  Jersey,  and  Maryland. 

•  Two  other  hijackers  briefly  took  introductory  flying  lessons  in  San  Diego  in  spring  of  2000, 
but  neither  sought  further  flight  training. 
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(U)  Banking  in  the  US 

(LES)  The  hijackers  financed  their  operation  with  money  electronically  transferred  from  overseas 
as  well  as  with  cash  and  traveler  checks  they  carried— and  declared — when  they  entered  the  US. 
They  opened  US  bank  accounts  and  used  them  legally,  but  they  favored  an  unusual  practice  of 
sharing  accounts  between  unrelated  members.  None  of  the  hijackers  worked  to  supplement  this 
funding. 

•  The  hijackers,  often  in  pairs,  used  24  bank  accounts  from  branch  banks  belonging  to  Sun 
Trust,  Hudson  United,  First  Union,  Bank  of  America,  and  Dime  Savings. 

i  ’ 

•  As  the  operation  drew  near,  the  hijackers  closed  the  majority  of  their  bank  accounts  and  wired 
most  of  the  remaining  money  overseas  through  Western  Union  stations  at  bus  terminals  and 
grocery  stores. 

(U)  How  They  Communicated 

(LES)  The  hijackers  favored  communications  techniques  designed  to  make  operational  discussions 
difficult  to  trace. 

•  They  used  pre-paid  calling  cards  combined  with  payphones  to  make  operational  telephone 
calls  to  conspirators  in  the  US  as  well  as  the  Middle  East  and  Germany,  according  to  law 
enforcement  information.  They  used  cell  phones  to  receive  operational  calls. 

•  They  apparently  reserved  their  most  sensitive  planning  discussions  for  face-to-face  meetings, 
which  likely  were  held  three  times  in  2001;  Germany  in  January,  Spain  in  July,  and  Las  Vegas 
in  mid-August. 

•  At  least  nine  hijackers  used  post  office  mailboxes  from  such  places  as  Mail  Boxes  Etc  and 
Mail  Depot,  possibly  to  receive  regular  mail  and  to  help  establish  residence. 

(U)  Businesses  They  Frequented 

(LES)  Besides  rental  car  businesses  and  commercially  available  post  office  boxes,  the  hijackers 
also  frequented  several  other  businesses. 

•  Many  of  the  hijackers  worked  out  at  gyms — possibly  to  help  prepare  them  for  subduing  passengers 
in  taking  over  the  airliners. 

•  They  used  Kinkos  for  photocopying  unknown  materials  and  for  computer  rentals. 

•  Marwan  al-Shehhi  also  visited  several  bars  during  his  stay  in  the  US  and  along  with  Hamza 
al-Gamdi  twice  in  July  2001  purchased  a  large  amount  of  pornography — $250,  and  $183 
worth — from  a  Video  Outlet  store  in  Florida. 
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(U)  Secondary  Missions  and  Travel 

(LES)  Besides  completing  their  primary  missions,  the  hijackers  also  may  have  scouted  for  follow-on 
attacks  or  secondary  targets. 

•  According  to  unconfirmed  information,  Mohamed  Atta  may  have  visited  the  Hoover  Dam  in 
August  2001 .  Atta  possibly  had  time  for  such  a  trip  during  his  visits  to  Las  Vegas. 

•  Marwan  al-Shehhi,  possibly  accompanied  by  Atta,  rented  a  camcorder  in  June  on  the  day  Atta 
began  a  weeklong  trip  through  Boston,  San  Francisco,  Las  Vegas,  and  New  York,  returning  it 
two  days  after  Atta  flew  back  to  Florida.  The  tape  has  never  been  recovered. 

•  Atta  and  al-Shehhi  twice  briefly  stayed  in  Virginia  Beach  and  traveled  to  Norfolk,  Virginia, 
raising  the  possibility  that  the  two  cased  local  military  facilities. 

•  Khalid  al-Mihdhar  and  Nawaf  al-Hamzi  lived  in  San  Diego  for  six  months  and  a  full  year 
respectively,  giving  them  ample  time  and  opportunity  to  case  military  facilities  throughout 
southern  California. 

•  Satam  al-Suqami  possibly  scouted  Disney  World  as  a  target  when  he  stayed  at  the  Doubletree 
Hotel — a  far  more  expensive  choice  than  the  hijackers  normal  accommodations — at  Walt 
Disney  World  from  10-12  July  2001. 

•  According  to  unconfirmed  law  enforcement  information,  Atta  inquired  about  crop  dusters  in 
February  2001,  even  after  he  had  trained  on  a  jet  simulator,  according  to  a  variety  of  reporting. 


(U)  Rituals 

(LES)  While  the  hijackers  made  a  special  effort  to  blend  in  and  conceal  their  jihadist  zeal,  this 
mask  cracked  in  the  closing  days  of  their  mission. 

•  A  maid  at  the  Days  Inn  in  Boston  where  the  Flight  175  hijackers  stayed  the  night  before  the 
attack  reported  finding  a  large  amount  of  body  hair  in  the  room,  all  of  the  rooms*  lotion  used — 
possibly  to  aid  the  shaving — and  that  they  had  only  slept  on  top  of  their  beds. 

•  Copies  of  the  same  letter  were  recovered  from  the  hijackers  belongings  that  detailed  steps  and 
prayers  that  were,  to  be  followed  before  the  attacks. 
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(LES)  Annex  A: 


(SE«RFT,N0F0RN,X1) 


the  11  September  Hijackers’  Operational  Tradecraft 


(LES)  There  are  some  similarities  between  the  1993  World  Trade  Center  (WTC)  bombers _ 

_ the  11  September  hijackers,  but  there  also  are  key  differences  that  make  it  difficult 

to  establish  a  single  pattern  that  sleeper  cells  in  the  US  likely  would  follow. 

(LES)  Key  operational  characteristics  common  to  the  1993  and  2001  plotters  include: 


•  Some  of  the  conspirators  from  both  plots  arrived  in  the  US  at  least  six  months  prior  to  the 
attacks — in  some  cases,  more  than  a  year — and  members  focused  their  time  and  energy  in 
preparing  for  the  attacks. 

\ 

•  Some  members  of  each  plot  used  shared  bank  accounts. 


The  key  leaders  of  both  plots- 


the  1 1  September  pilots — shared  a  variety  of  personal 


characteristics.  They  had  broad  exposure  to  the  West- 


three  of  the  four  pilots 


studied  in  Western  Europe  and  had  technical  backgrounds — spoke  workable  English,  were  in 
their  20s  or  early  30s,  and  hailed  from  affluent  families. 


(LES)  Key  operational  differences  include: 


jtraveled  together  from  Pakistan  and  used  false 

names  and  documents  to  enter  to  the  US,  while  all  19  hijackers  used  their  true  names,  legitimate 
passports,  and  secured  visas  to  enter  the  country. 


_ four  passports  and  three  different  names  to  enter,  operate,  and  exit  the 

US,  while  the  hijackers  acquired  legitimate  forms  of  identification,  such  as  driver’s  licenses 
and  state  identification  cards  in  their  true  name. 


a  local  network  of  childhood  friends  and  individuals  introduced  to  him  by 
others  after  his  arrival  in  the  US  to  carry  out  his  attack.  Most  had  no  significant  training  and 
indoctrination,  and  one  conspirator  was  brought  into  the  plot  two  weeks  before  the  attack. 
Conversely,  the  hijackers  relied  mainly  on  experienced,  well-trained  manpower  from  abroad 
and  did  not  bring  unknown  individuals  into  their  plot  after  arriving  in  the  US. 


The  1993  conspirators  frequently  made  overseas  phone  calls  from  their  residences,  while 
the  hijackers  relied  on  prepaid  cell  phones,  calling  cards,  and  Internet  cafes  to  communicate 
abroad. _ a  personal  computer,  but  the  hijackers  are  not  known  to  have  owned  laptop 


or  desktop  computers  or  any  electronic  data  storage  media. 


I 
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(LES)  Annex  B:  | _ 

Contrasts  in  Tradecraft 


the  11  September  Hijackers*  Tactics  in  the  US:  More 


(LES)  There  are  few  similarities  betweeij" 

Ithe  11  September  hijackers. 


•  1 

|the  11  September 

hijackers  exclusive  use  oflegitimate  documentation. 

The  11  September  plotters  sought  no  special 

immigration  status. 


[ 


Although[ 


all  spoke  workable  English. 


]  The  1 1  September  pilots 


In  contrast  to  the  11  September  hijackers 


conducted  surveillance  or  route  rehearsals  to  me  US,  otner  tnan  witn  a  map. 


In  his  debriefings 

rhe  11  September  hijackers 

t  t n  i  i  t 

used  legitimate  US  bank  accounts  and  either  legally  brought  money  to  the  US  or  had  it  electronically 
sent  from  the  Middle  East  to  their  accounts. 


practiced  operational  security  in  communicating 


Like  the  1 1  September  hijackers 
with  his  associates,  although  not  as  well, 
several  different  pay  phones,  but  used  a  cellular  phone  to  leave  messages  at  the  local  mosque 
for  associates  to  meet  him  there. 


Jmultiple  pre-paid  calling  cards  and 
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(U)  Annex  C:  List  of  Hijackers  and  Planes 


American  Airlines  Flight  11 

Departed  Boston — Crashed  into  the  north  tower  of  the  World  Trade  Center 
76  passengers  and  1 1  crew 

MohamedAtta 
Satam  al-Suqami 
Waled  al-Shehri 
Wa’il  al-Shehri 
Abdulaziz  ai-Omari 

United  Airlines  Flight  175 

Departed  Boston — Crashed  into  the  south  tower  of  the  World  Trade  Center 
51  passengers  and  nine  crew 

Marwan  al-Shehhi 
Fayez  Banihammad 
Ahmed  al-Ghamdi 
Hamza  al-Gamdi 
Mohand  al-Shehri 

American  Airlines  Flight  77 

Departed  Washington  Dulles — Crashed  into  the  Pentagon 
53  passengers  and  six  crew 

Hani  Hanjour 
Khalid  al-Mihdhar 
Majed  Moqed 
Nawaf  al-Hazmi 
Salem  al-Hazmi 

United  Airlines  Flight  93 

Departed  Newark — Crashed  near  Stony  Creek  Township,  Pennsylvania 
33  passengers  and  seven  crew 

Ziad  Jarrah 

Saeed  al-Ghamdi  r 

Ahmed  al-Haznawi 
Ahmed  al-Nami 
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